VPP - Process Safety and Management Supplementary Questionnaire

The VPP Application Supplement for Sites Subject to the Process Safety Management (PSM) Standard has
been submitted to the Office of Management and Budget (OMB) for review under the Paperwork
Reduction Act of 1995. No person may be required to respond to, or may be subject to a penalty for
failure to comply with, this supplement until it has been approved.
The public may submit comments on this application as well as other VPP information collection
requirements at http://www.reginfo.gov. You may also obtain an electronic copy of the complete Voluntary
Protection Information Collection Request (ICR) at this website. Click on "Inventory of Approved
Information Collections, Collections Under Review, Recently Approved/ Expired," then scroll under
"Currently Under Review" to Department of Labor (DOL) to view all of the DOL's ICRs, including those
ICRs submitted for extensions. To make inquiries, or to request other information, contact Mr. Todd Owen,
OSHA, Directorate of Standards and Guidance, Room N-3609, U.S. Department of Labor, 200 Constitution
Avenue, NW., Washington, DC 20210; telephone (202) 693-2222.

VPP Application Supplement
for
Sites Subject to the Process Safety Management (PSM) Standard
VPP applicants whose operations are covered by the Process Safety Management (PSM)
Standard must provide responses to each question that is applicable to their operations.
Responses must cover all PSM-related operations. Please indicate that a question is “Not
Applicable” if it addresses functionality outside the scope of the operations, and briefly
explain why.
I.

II.

Management of Change.
A.

Has the throughput changed from its original design rate? Has the site
conducted a management of change (MOC) procedure for each throughput
change since May 26, 1992?

B.

For the MOC procedures conducted for the unit(s), has the procedure
listed the technical basis for the change and ALL potential safety and
health impacts of the change prior to its implementation?

C.

From the site’s list of MOCs, identify the oldest MOC procedure which
might affect the integrity of one or more pressure vessels in the unit(s).
Do these MOC procedures meet all 1910.119(l) requirements?

D.

Does the MOC process address temporary changes as well as permanent
changes?

E.

Have MOCs been conducted on all changes to process chemicals,
technology, equipment and procedures, and changes to facilities that affect
a covered process?

Relief Design.
A.

For each throughput MOC procedure conducted, has the procedure
1

addressed a review/analysis of the relief system (includes relief devices,
relief discharge lines, relief disposal equipment and flare system) to
determine if there may be any safety and health impacts due to increased
flow as a result of throughput changes which might impact the existing
relief system?
Guidance: An MOC procedure is required anytime a change per the
requirements of 1910.119(l) is considered. An MOC procedure is a
proactive management system tool used in part to determine if a change
might result in safety and health impacts. OSHA’s MOC requirement is
prospective. The standard requires that an MOC procedure be completed,
regardless of whether any safety and health impacts will actually be
realized by the change.
B.

After a change in the throughput in the unit(s), did the process hazard
analysis (PHA) team consider the adequacy of the existing relief system
design with respect to the increased throughput during the next PHA?
Guidance: Typically, the PHA team does not do a relief system
engineering analysis. However, the PHA team should determine, through
proper evaluation and consultation with the engineering/technical staff, if
the existing/current engineering analysis of the relief system is adequate
for the current/actual unit throughput.
If the throughput change was implemented between the time the PSM
standard became effective (May 26, 1992) and the time the original PHA
was required based on the PHA phase-in schedule, the original PHA
would need to address the throughput change. However, if there was a
throughput change after the original PHA, the next PHA update/”redo”
or PHA revalidation would need to address the throughput change. In
either event, an MOC procedure on the throughput change would need to
have been conducted and incorporated into the next scheduled PHA.

C.

Does the site's process safety information (PSI) include the codes and
standards used in the design of relief systems?

D.

Does the site’s PSI include the relief system design and design basis?
Guidance: This includes the original design and design changes.
Examples of PSI related to relief devices, their design and design basis
include, but are not limited to such items as:
1.
2.
3.

Identification/descriptor of each relief device;
A listing of all equipment which will be relieved through the
device;
Design pressure;

2

4.
5.
6.
7.

8.

9.

Set pressure;
Listing of all sources of overpressure considered;
Identification of the worst case overpressure scenario or relief
design;
State of material being relieved (i.e.,, liquid, vapor, liquid-vapor,
liquid-vapor-solid, along with an identification of the material
which was the basis for the relief device selection);
Physical properties of the relieved materials, vapor rate,
molecular weight, maximum relieving pressure, heat of
vaporization, specific gravity and viscosity; and
Design calculations.

Similar design and design bases PSI are required for the rest of the relief
system equipment downstream from the relief devices, i.e., relief vent
lines, manifolds, headers, other relief disposal equipment, and flare stack.
E.

Are there intervening valves on the upstream or downstream lines to/from
relief devices? If so, does the PHA consider the possibility that these
valves could be closed during operation, rendering the relief devices nonfunctional?

F.

If there are intervening valves on the upstream or downstream lines
to/from relief devices, does the site have effective controls in place to
ensure these intervening valves remain open during operations?

G.

If there are intervening valves on the upstream or downstream lines
to/from relief devices, is there an administrative procedure (e.g., car-seal
procedure) to assure these valves are in the open position during
operations? If so, has this procedure been subsequently audited?

H.

Are there open vents which discharge to atmosphere from relief devices?
If so, has the PHA considered whether these relief devices discharge to a
safe location?
Guidance: PHA teams must address basic questions regarding what
happens to the hazardous materials after they are relieved to atmosphere,
including:
1.

Are there negative effects on employees or other equipment that
could cause another release (“domino effects”) of hazardous
materials/HHC?

2.

What presumptions or assessments exist to support that there will
be no negative effects of an atmospheric release of hazardous
materials/HHC?

3

3.

Are employees near where relief devices discharge, including
downwind locations (e.g., on the ground, on platforms on pressure
vessels in the vicinity of elevated relief devices, etc.)?

4.

Could a release from a relief device cause a release from other
equipment, or could other nearby equipment affect the released
material (e.g., a furnace stack could be an ignition source if it is
located proximate to an elevated relief device that is designed to
relieve flammable materials)?

Part of the site’s PHA team’s evaluation, after it identifies the locations of
open vents, is to determine if employees might be exposed when hazardous
materials are relieved. If the PHA team concludes that a current and
appropriate evaluation (such as the use of dispersion modeling) has been
conducted, the evaluation could find that the vessels/vents relieve to a safe
location. If the PHA team determines that this hazard has not been
appropriately evaluated, the PHA team must request that such an
evaluation be conducted, or make some other appropriate
recommendation to ensure that the identified hazard/deviation is
adequately addressed.

III.

I.

Does the site have a mechanical integrity (MI) procedure for inspecting,
testing, maintaining, and repairing relief devices which maintains the
ongoing integrity of process equipment?

J.

Does the process use flares? If so, verify that the flares have been inservice/operational when the process has been running. If the flares have
not been in-service, has the site used other effective measures to relieve
equipment in the event of an upset? Has an MOC procedure been used to
evaluate these changes?

Vessels.
A.

Do pressure vessels which have integrally bonded liners, such as strip
lining or plate lining, have an MI procedure which requires that the next
scheduled inspection after an on-stream inspection be an internal
inspection?

B.

Does the site have an MI procedure for establishing thickness
measurement locations (TML) in pressure vessels, and does the site
implement that procedure when establishing the TML?

C.

Does the site have an MI procedure for inspecting pressure vessels for
corrosion-under-insulation (CUI), and does the site inspect pressure
vessels for CUI?

4

D.

Does the site’s MI procedure address testing (e.g. leak testing) and repair
of pressure vessels? For example, does the MI procedure indicate how the
testing and repair will be conducted and which personnel are authorized to
do the testing and repair, including what credentials those conducting the
testing and repair must have?
Guidance: API 510 requires in-service pressure vessel tests when the API
authorized pressure vessel inspector believes they are necessary.
Guidance: Recognized and Generally Accepted Good Engineering
Practices (RAGAGEP) that require credentials include, but are not limited
to:

E.

1.

Credentials for pressure vessel inspectors, see API 510, Section
4.2.

2.

RAGAGEP for pressure vessel examiners credentials/experience
and training requirements, see API 510, Section 3.18.

3.

RAGAGEP for contractors performing NDE are the training and
certification requirements ASNT-TC-1A, see CCPS, Section
10.3.2.1, (In-service Inspection and Testing) Nondestructive
Examination.

4.

RAGAGEP for qualifications for personnel who conduct pressure
vessel repairs, alteration and rerating including qualifications for
welders, see API 510, Section 7.2.1 and the BPVC, Section IX.

5.

RAGAGEP for certifications at CCPS, Section 5.4 Certifications,
Table 5-3, Widely Accepted MI Certifications, and Table 9-13,
Mechanical Integrity Activities for Pressure Vessels.

Were any deficiencies found during pressure vessel inspections? If so,
how were they resolved?
Guidance: A deficiency (as per 1910.119 (j)(5)) means a condition in
equipment or systems that is outside of acceptable PSI limits. In the case
of a pressure vessel, this could mean degradation in the equipment/system
exceeding the equipment’s acceptable limits (e.g., operating a vessel, tank
or piping with a wall thickness less than its retirement thickness).

F.

Do the operating procedures for pressure vessels list the safety systems
that are applicable to the vessels?
Guidance: Examples of safety systems include but are not limited to:
emergency relief systems including relief devices, disposal systems and

5

flares; automatic depressurization valves; remote isolation capabilities,
aka emergency isolation valves; safety-instrumented-systems (SIS)
including emergency shutdown systems and safety interlock systems; fire
detection and protection systems; deluge systems; fixed combustible gas
and fire detection system; safety critical alarms and instrumentation;
uninterruptible power supply; dikes; etc.
G.

IV.

Have there been any changes to pressure vessels or other equipment
changes that could affect pressure vessel integrity, such as a change to
more corrosive feed, a change in the type of flange seal material used for
the vessel heads or nozzles, etc.,? If so, was an MOC procedure
completed prior to implementing the change?

Piping.
A.

Is there information in the MI piping inspection procedures or other PSI
that indicates the original thickness measurements for all piping sections?

B.

Is there information in the MI piping inspection procedures or other PSI
that indicates the locations, dates and results of all subsequent thickness
measurements?

C.

Is there anomalous data that has not been resolved for any piping? (For
example, the current thickness reading for a TML indicates the pipe wall
thickness is greater/thicker than the previous reading(s) with no other
explanation as to how this might occur.)

D.

Has each product piping been classified according to the consequences of
its failure?
Guidance: If the site inspects and tests all piping the same, regardless of
the consequence of failure of the piping (i.e., piping inspections are
implemented using the same MI program (1910.119(j)(2) and action/task
(1910.119(j)(4) procedure for all piping without consideration of their
consequence of failure or other operational criteria), then this question is
not applicable.

E.

Based on a review of piping inspection records, have all identified piping
deficiencies been addressed?
Guidance: An example of a piping deficiency would be a situation where
piping inspection data indicates that its actual wall thickness is less than
its retirement thickness, and the site has conducted no other evaluation to
determine if the piping is safe for continued operation. For a discussion
on equipment deficiencies the definition of deficient/deficiency.

6

F.

How does the site ensure that replacement piping is suitable for its process
application?
Guidance: Typically, piping replacements are replacements-in-kind (RIK)
when the process service does not change. However, if the piping
replacement is not an RIK, then an MOC procedure is required.

V.

G.

Does the site’s MI procedure list required piping inspectors’
qualifications, welders’ qualifications for welding on process piping, and
when qualified welding procedures are required?

H.

Is there information in the MI piping inspection procedures or other PSI
that indicates the original installation date for each section of piping?

I.

Is there information in the MI piping inspection procedures or other PSI
that indicates the specifications, including the materials of construction
and strength levels for each section of piping?

J.

Does the site’s MI procedure for piping inspections list criteria/steps to be
followed when establishing TML for injection points in piping circuits?

Operating Procedures – Normal Operating Procedures (NOP), Emergency
Shutdown Procedures (ESP) and Emergency Operations (EOP).
A.

Are there established operating procedures, including: normal operating
procedures (NOP), emergency operating procedures (EOP), and
emergency shutdown procedures (ESP)?

B.

Are operating procedures implemented as written?

C.

Are there ESP for the all Unit(s), and if so, do these ESP specify the
conditions that require an emergency shutdown?
Guidance: ESP are usually warranted during events that may include the
failure of process equipment (e.g., vessels, piping, pumps, etc.) to contain
or control HHC releases, loss of electrical power, loss of instrumentation
or cooling, fire, explosion, etc. When EOP do not succeed during upset or
emergency conditions in returning the process to a safe state,
implementation of an ESP may be necessary.
When normal operating limits for parameters such as pressure,
temperature, level, etc., are exceeded during an excursion, system upset,
abnormal operation, etc., a catastrophic release can occur if appropriate
actions are not taken. These actions must be listed in the EOP and must
specify the initiating conditions or the operating limits for the EOP (e.g.,
temperature exceeds 225oF or pressure drops below 15 psig).

7

Information typically listed in EOP and/or ESP includes, but is not limited
to the responsibilities for performing actions during an emergency,
required PPE, additional hazards not present during normal operations,
consequences of operating outside operating limits, steps to shutdown the
involved process in the safest, most direct manner, conditions when
operators must invoke the emergency response plan, or scenarios when
they themselves must stop and evacuate.
D.

Have control board operators received sufficient training, initial and
refresher, to be qualified to shutdown the units?

E.

Does the ESP specify that qualified operators are assigned authority to
shutdown the unit(s)?

F.

Are qualified control board operators authorized or permitted to initiate an
emergency shutdown of the unit without prior approval?

G.

Do EOP procedures identify the “entry point,” i.e., the initiating/triggering
conditions or operating limits when the EOP is required, the consequences
of a deviation from the EOP, and the steps required to correct a
deviation/upset once the operating limits of the EOP have been exceeded?

H.

Do NOP list the normal operating limits or “exit points” from NOP to
EOP; the steps operators should take to avoid deviations/upsets; and the
precautions necessary to prevent exposures, including engineering and
administrative controls and PPE?
Guidance: For NOP, the "operating limits" required are those operating
parameters that if they exceed the normal range or operating limits, a
system upset or abnormal operating condition would occur which could
lead to operation outside the design limits of the equipment/process and
subsequent potential release. These operating parameters must be
determined by the site and can include, but are not limited to, pressure,
temperature, flow, level, composition, pH, vibration, rate of reaction,
contaminants, utility failure, etc.
It is at the point of operation outside these NOP "operating limits" that
EOP procedures must be initiated. There may be a troubleshooting area
defined by the site's EOP where operator action can be used to bring the
system upset back into normal operating limits. During this
troubleshooting phase, if an operating parameter reaches a specified level
and the process control strategy includes automatic controls, other safety
devices (e.g., safety valves or rupture disks) or automatic protection
systems (e.g., safety instrumented systems/emergency shutdown systems),
would activate per the process design to bring the process back to a safe

8

state. Typically, once the predefined limits for troubleshooting have been
reached for a particular operating parameter, the process has reached a
"never exceed limit". A buffer zone is typically provided above( and below
if applicable) the trouble shooting zone ("never exceed limit") to ensure
the operating parameters do not reach the design safe upper or lower limit
of the equipment/process. This design safe upper and lower limits of the
equipment or process are also known as the boundaries of the design
operating envelope or the limit above (or below) which it is considered
unknown or unsafe to operate. Once the operating parameter(s) reach the
buffer zone entry point, there is no designed or intentional operator
intervention (i.e., troubleshooting) to bring the process system upset back
to a safe state. Any intervention in the buffer zone is as a result of the
continued activation of the safety devices and automatic protection
systems which initially activated at the predefined level during the
troubleshooting phase. All of these predefined limits are important
information for operators to know and understand and must be included in
the PSI and operating procedures.
I.
VI.

Are operating procedures implemented as written?

PHA, Incident Investigation, and Compliance Audits Findings/Recommendations.
A.

Have all corrective actions from PHA, incident investigations, MOCs, and
compliance audits been corrected in a timely manner and documented?
Provide a list of all outstanding corrective actions, the date of corrective
initiation, and the projected completion dates.
Guidance: There may be instances when a PHA team identifies
deficiencies in equipment/systems which would violate the requirements of
119(j)(5) if left uncorrected. If the site continues to operate the deficient
equipment/system, they must take interim measures per 119(j)(5) to assure
safe operation, and they must also meet the 119(e)(5) requirements to
resolve the findings and recommendations related to the identified
deficiency.
The phrase from 119(j)(5), “safe and timely manner when necessary
means are taken to assure safe operation”, when taken in conjunction with
119(e)(5) means that when a PHA team identifies a deficiency in
equipment/systems and the site does not correct the deficiency before
further use, the site’s system for promptly addressing the PHA team's
findings and recommendations must assure: 1) that the recommendations
are resolved in a timely manner and that the resolutions are documented;
2) the site has documented what actions are to be taken, not only to
resolve the recommendation, but to assure safe operation until the
deficiency can be corrected; 3) that the site complete actions as soon as
possible; and 4) that the site has developed a written schedule describing

9

when corrective actions related to the resolution and any interim
measures to assure safe operations will be completed.
The system that promptly addresses and resolves findings and
recommendations referred to in both 1910.119(e)(5) and 1910. 119(m)(5)
are not requirements to develop a management program for globally
addressing the resolution of findings and recommendations. Rather, these
“system” requirements address how each specific finding and
recommendation will be individually resolved (Hazard Tracking
requirement under VPP). Each finding or recommendation will have its
own unique resolution based on its nature and complexity.
B.

VII.

Has the PHA incorporated all the previous incidents since May 26, 1992
which had a likely potential for catastrophic consequences?

Facility Siting/Human Factors.
A.

Does the PHA consider the siting of all occupied structures?
Guidance: Facility siting considerations for occupied structures include
both permanent and temporary (e.g., trailers) structures.
Global/generic facility siting questionnaires/checklists. Some employers
(PHA teams) attempt to comply with this 1910.119(e)(3)(v) requirement by
answering global/generic facility siting questions on a short
questionnaire/checklist. PSM is a performance standard and the means
the site uses to comply with the standard are generally up to them as long
as their performance ensures compliance with the requirement of the
standard. If the site uses a questionnaire/checklist as part of its PHA to
identify, evaluate and control all hazards associated with facility siting,
this is permissible as long as the method they used complies with the PHA
methodology requirement, and, more importantly, all facility siting
hazards have been addressed (i.e., identified, evaluated and controlled).
This questionnaire/checklist type of methodology would not be compliant
if the site (PHA team) did not have specific justifications for each
individual situation/condition that the global/generic questions addressed.
For example, a PHA team responds "Yes" to a questionnaire/checklist
asking, “Is process equipment located near unit battery limit roads sited
properly?” In this case, OSHA would first expect that the site (PHA team)
would have identified each location where process equipment is sited near
a unit battery limit road. Next, OSHA would expect the site would have
evaluated each piece of process equipment located in the vicinity of a
roadway. This evaluation is conducted to determine if each of the specific
process equipment’s siting is adequate/controlled (e.g., guarded by crash
barriers, elevated on a concrete pedestal, etc.) to protect it from releasing

10

its hazardous contents should it be struck by vehicular traffic. Without
specific justification or other specific evidence that corroborates the site’s
“Yes” response to this global/generic questionnaire/checklist question, a
possible regulatory issue could exist for failing to address process
equipment siting near roadways when it conducted its PHA.
Guidance: Occupancy Criteria Evaluations for Employee Occupied
Structure. OSHA does not accept occupancy criteria evaluations (see API
752, Section 2.5.2) as the basis for a site’s determination that adequate
protection has been provided for employees in occupied structures which
sites have identified as being potentially subject to explosions, fires,
ingress of toxic materials or high energy releases. In these occupancy
criteria evaluations, the site identifies vulnerable employee occupied
structures and the hazards they may be subjected to, but rather than
providing protection to either the structures or employees through
measures like employee relocation, spacing, or protective construction,
the site simply accepts the employee exposures as adequate based on their
own acceptable occupancy criteria. This occupancy criteria evaluation is
solely based on the occupancy threshold criteria a site is willing to accept.
For instance, API 752 list occupancy threshold criteria used by some
companies as 400 personnel hours per week as acceptable exposure for
employees in an occupied structure, regardless of the magnitude of the
hazard these employees are potentially exposed to. The 400 personnel
hours per week equates to 2 employees continually exposed in an occupied
structure even if that structure has virtually no protective construction and
it is sited immediately adjacent to a high pressure-high temperature
reactor which contains flammable or extremely toxic materials.
Non-Essential Employees. A site’s PHA facility siting evaluation must
consider the presence of non-essential personnel in occupied structures in
or near covered processes. The “housing” of these non-essential
employees in occupied structures near operating units may expose them to
explosion, fires, toxic material, or high energy release hazards. Therefore,
unlike direct support/ essential personnel (e.g., operators, maintenance
employees working on equipment inside a unit, field supervisors, etc.) who
are needed to be located in or near operating units for logistical and
response purposes, sites (PHA teams) must consider and justify why nonessential employees are required to be located in occupied structures
which are vulnerable to the hazards listed above. The term “nonessential” identifies those employees who are not needed to provide direct
support for operating processes. Non-essential employees include, but are
not limited to, administrative personnel, laboratory employees when they
are working inside a lab, maintenance staff when they are working inside
maintenance shops/areas, and employees attending training classes.
Guidance: An example of how a temporary structure could affect a

11

release of HHC would include a situation where a trailer’s unclassified
electrical system could potentially ignite flammable materials/unconfined
vapor cloud if released from the process.
B.

Do the PHA teams identify and evaluate all situations where operators are
expected to carry out a procedure to control an upset condition, but where
the operators would not have enough time to do so based on operating
conditions?

C.

Do the PHA team(s) identify and evaluate all situations where field
employees must close isolation valves during emergencies, but where
doing so would expose the employees to extremely hazardous situations?
For example, to isolate a large inventory of flammable liquids, a
downstream manual isolation valve would need to be closed, but the
isolation valve is located in an area that could be consumed by fire.
Guidance: Some sites (PHA teams) attempt to comply with this
requirement by simply addressing some global/generic human factors
questions on a short questionnaire/checklist. This type of methodology
would not, by itself, be adequate if the PHA team did not have specific
justifications for each of its global/generic responses.
For example, if a PHA team responds "Yes" to a questionnaire/checklist
asking whether emergency isolation valves (EIV) are accessible during
emergencies, OSHA would then expect that the PHA team had identified,
evaluated, and considered each EIV’s accessibility ( i.e., would the EIV be
located in an area that might be consumed in fire, or is the EIV located
above grade).

D.

VIII.

How do the PHA teams identify likely human errors and their
consequences? Have appropriate measures been taken to reduce the
frequency and consequences of these errors?

Operator Training.
A.

Have operating employees been trained on the procedures each is expected
to perform?
Guidance: An "A" operator might be required to perform a different set of
operating procedures than a "C" operator. Therefore, to determine if the
employee has in fact been trained on the specific operating procedures
they are expected to perform, cross-reference the specific procedures that
an individual operator is expected to perform with the training records of
the specific procedures for which the individual operator has received
training. Also determine if operators perform tasks more than what is
expected for their level of training.

12

IX.

B.

From interviews with control board operators in the units, have these
operators received sufficient training, initial and refresher, to be qualified
to shutdown the units per the requirements of 119(f)(1)(i)(D)?

C.

Based on the employer's explanation of their management of operator
refresher training, verify that selected operating employees received,
completed, and understood the refresher training. For each employee who
operates a process, has the employer ensured that the employee
understands and adheres to the current operating procedures and that the
refresher training is provided at least every three years, and more often if
necessary?

Safe Work Practices.
A.

Does the site have a safe work practice which it implements for motorized
equipment to enter operating units and adjacent roadways?
Guidance: “Motorized equipment” includes, but is not limited to
automobiles, pickup trucks, fork lifts, cargo tank motor vehicles (CTMV),
aerial lifts, welder’s trucks, etc.

X.

B.

Does the site audit its safe work practices/procedures for opening process
equipment, vessel entry, and the control of entrance to a facility or covered
process area?

C.

Does the site have a safe work practice for opening process equipment,
e.g. piping and vessels, and does the site require their employees and
contractor employees to follow it?

Incident Investigation Reports.
A.

Provide a list of actual incidents and near-miss incidents that occurred at
the site within the last year. Have all factors that contributed to each of
the incidents been reported and investigated?
Guidance: An “actual incident” is defined as an incident with negative
consequences such as a large HHC release, employee injuries or fatality,
or a large amount of property or equipment damage. Typically, based on
loss-control history, there is a much higher ratio of near-miss incidents in
the chemical processing and refining industries than there are actual
incidents.

XI.

Blowdown Drums and Vents Stacks (Blowdowns).

13

A.

Does the site have any blowdowns? If so, does the PSI include the
original design and design basis for each blowdown at the site?
Guidance: Blowdown(s) – refers to a piece of disposal equipment in a
pressure-relieving system whose construction consists of a drum to collect
liquids that are separated (“knockout”) from vapors and a vent stack,
which is an elevated vertical termination discharging vapors into the
atmosphere without combustion or conversion of the relieved fluid.
Blowdown(s) are separate vessels intended to receive episodic (e.g., when
de-inventorying a vessel for a planned shutdown) or emergency
discharges. Blowdown(s) are designed to collect liquids and to dispose of
vapors safely. In the refinery industry, hydrocarbons typically enter
blowdown(s) as liquids, vapors, or vapors entrained with liquids.
Blowdown(s) typically include quench fluid systems which reduce the
temperature of hot, condensable hydrocarbons entering the blowdown as
well as the amount of vapor released via the vent stack. These systems
can include internal baffles to help disengage liquids from hydrocarbon
vapors. Sometimes, blowdown(s) include inert gas or steam systems to
control flashback hazards and to snuff vent stack fires if ignited by sources
such as lightning
Examples of PSI related to blowdowns, their design and design basis
include, but are not limited to, such items as:
1.

Physical and chemical properties of the materials relieved to
blowdowns (See API STD 521, Section 6.2.1);
Guidance: Of particular concern are heavier-than-air
hydrocarbons with relatively lower boiling points. Additionally,
hot hydrocarbons pose a greater risk because they are more
volatile. Releasing these materials under the right conditions can
result in the formation of unconfined vapor clouds which can and
have resulted in major catastrophes at refineries and chemical
plants.

2.

A definition of the loadings to be handled (See API STD 521,
Section 7.1);

3.

The exit velocity of gasses/vapors released from the vent stack (See
API STD 521, Section 7.3.4);

4.

Design basis/“worst-case” scenario for maximum liquid – vapor
release to blowdown (See API STD 521, Section 4.5.j and 7.1.3);

5.

When more than one relief device or depressuring valve
discharges to a blowdown, the geographic locations of those

14

devices and valves must be defined (See API STD 521, Section
4.4.q. and 7.2.3);

B.

6.

The design residence time of vapor and liquid in the drum (See API
STD 521, Section 7.3.2.1.2);

7.

The design basis for the vapor – liquid separation for the drum;

8.

The design basis for the exit velocities for the vent stack; and

9.

The nature of other, lesser hazards related to smaller releases not
related to the design “worst-case” scenario such as the release of
toxic (e.g.,, H2S) and corrosive chemicals.

Since the original installation of the blowdowns, have the original design
and design basis conditions remained the same? If not, was an MOC
conducted to determine if the blowdown design and capacity are still
adequate?
Guidance: Examples of conditions that may have changed since the
original design and installation of the blowdowns include: increased
throughput in the unit(s) that relieve to the blowdowns; additional relief
streams routed to the blowdown, blowdowns originally designed only to
handle lighter-than-air vapor emissions from their stacks have had liquids
or other heavier-than-air releases emitted from their vent stacks;
additional equipment, a new unit, or occupied structures have been sited
near the blowdowns in a manner that was not addressed in the original
design or design basis, etc.

C.

Did the PHA identify all scenarios where hot, heavier-than-air, or liquid
hydrocarbons might be discharged from blowdown stacks to the
atmosphere?

D.

Can the site demonstrate that atmospheric discharges from blowdowns are
to safe locations?
Guidance: Other structures such as control rooms, trailers, offices, motor
control centers, etc., must be considered in a PHA to determine if they
have been sited in a safe location that might be affected by a hydrocarbon
or toxic material release from a blowdown. Unsafe locations can include,
but are not limited to, the location of equipment which could act as an
ignition source, such as a furnace stack; an employee platform on a
column where employees would be exposed in the event of a release; a
control room; a satellite building; a trailer; a maintenance area/shop; an
emergency response building; an administration building; a lunch or
break room; etc.

15

E.

If there is a high-level alarm in the blowdown drum, is there an MI
procedure for calibrating, inspecting, testing and maintaining the
instrument/control?
Guidance: The required documentation data must include the date of the
inspection or test, the name of the person who performed the inspection or
test, the serial number or other identifier of the equipment on which the
inspection or test was performed, a description of the inspection or test
performed, and the results of the inspection or test.

F.

Have blowdown operators received appropriate training, either initial or
refresher?

16